🤖 DroidGround Companion

This sub-project is heavily based on the aya server which works the same way as the scrcpy server: a Java application that can be run on Android because the classes are dexed. An application built in this way can be run with the following command:

adb shell CLASSPATH=/data/local/tmp/classes.dex app_process / my.package.MainClass

🤝 Communication

The application waits for a connection on the droidground UNIX abstract namespace socket and communicates with the client using protobuf. The application currently supports the following methods:

• getVersion: which returns the value of BuildConfig.VERSION_NAME
• getPackageInfos: which returns structured info about the applications
• getAttackSurfaces: which returns the exported activities, broadcast receivers, services and content providers for the requested applications.
• getAPKPackageName: which returns the package name of an APK file on the device.

✍ Usage

1. Build the Android app server:

   ./gradlew assembleRelease
   

2. Push the server binary to the device:

   adb push droidground-companion.dex /data/local/tmp
   

3. Start the companion app:

   adb shell CLASSPATH=/data/local/tmp/droidground-companion.dex app_process /system/bin com.secforce.droidground.Server
   

4. The server listens for incoming protobuf-based client connections (on localabstract:droidground).

🙏 Acknowledgements

This wouldn't exist if it wasn't for aya and scrcpy.